From 21042cbb657666b6ce8c716fc94f710d96f8951c Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Wed, 19 May 2021 12:08:24 +0200 Subject: [PATCH 1/2] Fix #81048: phpinfo(INFO_VARIABLES) "Array to string conversion" Now that we're properly dereference references of the superglobals. we also need to dereference contained references to avoid to string conversion. --- ext/standard/info.c | 3 +++ ext/standard/tests/bug81048.phpt | 28 ++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 ext/standard/tests/bug81048.phpt diff --git a/ext/standard/info.c b/ext/standard/info.c index 245ffe026805b..d9b3e34647c4e 100644 --- a/ext/standard/info.c +++ b/ext/standard/info.c @@ -202,6 +202,9 @@ static ZEND_COLD void php_print_gpcse_array(char *name, uint32_t name_length) } else { php_info_print(" => "); } + if (Z_TYPE_P(tmp) == IS_REFERENCE) { + ZVAL_DEREF(tmp); + } if (Z_TYPE_P(tmp) == IS_ARRAY) { if (!sapi_module.phpinfo_as_text) { zend_string *str = zend_print_zval_r_to_str(tmp, 0); diff --git a/ext/standard/tests/bug81048.phpt b/ext/standard/tests/bug81048.phpt new file mode 100644 index 0000000000000..2f36a2774ff13 --- /dev/null +++ b/ext/standard/tests/bug81048.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion") +--FILE-- + ['bar' => ['baz' => 'qux']]]; + +array_walk_recursive($_SERVER, function($value, $key) { + // NOP +}); + +phpinfo(INFO_VARIABLES); +?> +--EXPECT-- +phpinfo() + +PHP Variables + +Variable => Value +$_SERVER['foo'] => Array +( + [bar] => Array + ( + [baz] => qux + ) + +) From 5b9fc1d7ad117f0d9b94b0375c18311059de7884 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Wed, 19 May 2021 12:28:37 +0200 Subject: [PATCH 2/2] Drop superfluous reference check --- ext/standard/info.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ext/standard/info.c b/ext/standard/info.c index d9b3e34647c4e..120d442b3d20d 100644 --- a/ext/standard/info.c +++ b/ext/standard/info.c @@ -202,9 +202,7 @@ static ZEND_COLD void php_print_gpcse_array(char *name, uint32_t name_length) } else { php_info_print(" => "); } - if (Z_TYPE_P(tmp) == IS_REFERENCE) { - ZVAL_DEREF(tmp); - } + ZVAL_DEREF(tmp); if (Z_TYPE_P(tmp) == IS_ARRAY) { if (!sapi_module.phpinfo_as_text) { zend_string *str = zend_print_zval_r_to_str(tmp, 0);